Two different hacker groups are exploiting the same still-unpatched vulnerability in Internet Explorer (IE) with almost-identical attack code, a security researcher said Tuesday.

The attacks, the first campaign unearthed last week by FireEye and a second campaign found by Websense, exploit a flaw in IE9 and IE10, two editions of Microsoft's browser. Attacks have been spotted targeting only IE10, however.

GIFAS is best known to the public as the sponsor of the Paris Air Show, where commercial and military aircraft makers strut their newest fixed-wing planes and helicopters.

Aviv Raff, chief technology officer at security firm Seculert, contended that the attacks uncovered by FireEye and Websense were the work of two gangs.

"Our analysis reveals that a totally different malware than ZXShell, the culprit as identified by FireEye, was used [in the attacks found by Websense]," Raff wrote on his company's blog Tuesday.

Raff confirmed that Seculert believed two different groups of cyber criminals were at work, both leveraging the same IE zero-day vulnerability, in an interview conducted via instant message Tuesday.

"We do see similar variations of zero-day exploits, but zero-day [vulnerabilities] that were never publicly disclosed before, that is not that common [for two groups to use simultaneously]," Raff said in that interview.

He speculated that the two hacker gangs probably obtained the attack code from the same third-party by purchasing it on the black market. "The elements of the exploits are almost identical," Raff added, explaining his reasoning.

Although Microsoft has acknowledged that both 2011's IE9 and 2012's IE10 contain the vulnerability, it has yet to issue an official security, the usual first step towards publishing a patch. Nor has the Redmond, Wash. company's security team named any temporary defensive measures, which are frequently offered in the "Fixit" format.

Instead, Microsoft has encouraged users to upgrade to IE11, which is immune to the attacks. However, Windows Vista owners running IE9 cannot migrate to IE11 as the latter does not support the little-used Vista.

Raff also said Seculert's research had found that the malware used in the GIFAS campaign had changed the hosts files of the infected machines to redirect any remote access software traffic through the hackers' servers so that they could steal log-on credentials.

"The domains that were added to the hosts file by the malware provide remote access to the employees, partners, and third-party vendors of a specific multinational aircraft and rocket engine manufacturer," said Raff on the blog.

Seculert did not identify the manufacturer by name, but an accompanying screenshot on the blog showed the logo of Safran SA, a Paris-based multinational aerospace and defense contractor whose subsidiaries produce commercial and military aircraft engines, and both liquid- and solid-fueled rocket motors.

Engines made by Safran power some of the French Air Force's Mirage 2000 jet fighters.

ARN Distributor Directory

ARN Vendor Directory

Slideshows

Opening ice breaker sessions set the scene for EDGE 2017

​EDGE 2017 kicked off with an opening ice breaker session, providing a structured environment for channel executives to form and foster new relationships and business opportunities. Photos by Maria Stefina.​

ARN returns to Melbourne for second running of After Hours

Partners, vendors and distributors came together for the second running of After Hours in Melbourne, designed to further unite the Australian channel through a series of invite-only social events in Victoria. Photos by Raymond Korn.​

A bumper crowd of partners turned out in force for Synnex Alliance 2017 in Melbourne, uncovering the key channel strategies required to deliver on the potential of digital transformation in Australia. An evening of keynote speakers, panel discussions and technology exhibitions assessed the opportunities and challenges of digital at Melbourne Olympic Park, with Sydney next up on August 16. Photos by Raymond Korn.

Copyright 2017 IDG Communications. ABN 14 001 592 650. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.